[copilot-cli-research] Copilot CLI Deep Research - 2026-06-25

[github-actions[bot]]

Analysis Date: 2026-06-25 | Run: §28147943509
Scope: 251 total workflows · 125 Copilot (50%) · 63 SDK · 7th consecutive weekly run

---

📊 Executive Summary

Copilot engine now powers 50% of all workflows (125/251, +4 vs last week). The most significant single-week change is model overrides jumping from 42 → 67 workflows (+60%) — the team is rapidly experimenting with model selection. Yet the companion safety features (max-tool-denials, engine.token-weights) remain at 0 adoption. Three critical safety/reliability gaps have been flagged in every research cycle for 5+ weeks without any adoption.

---

🔴 Critical Findings (Persistent Gaps — 5+ weeks unresolved)

Gap	Impact	Count	Since
max-tool-denials: 0	SDK workflows can loop infinitely against guardrails, burning AI credits	0/63 SDK	May-21
min-integrity regression	Dropped from 43→35 workflows — 8 workflows lost injection protection	35 (-8)	Jun-22
engine.mcp.tool-timeout: 0	Hung MCP calls silently consume timeout budget instead of failing fast	0/251	May-26

---

🟡 Medium Priority

Opportunity	Current	Benefit
engine.token-weights	0/67 model-override workflows	Accurate max-ai-credits enforcement as models diversify
engine.mcp.session-timeout	0/72 cache-memory workflows	Garbage-collect stale MCP sessions in long-running agents
network.blocked	0 workflows	Denylist specific domains within allowed ecosystems
Orphaned agent files	5/11 .github/agents/ unused	grumpy-reviewer, w3c-specification-writer etc. available but never used
tools.startup-timeout	1/251	Prevent flaky MCP startup from silently failing

---

📈 Trends (May 2026 → Jun-25)

Metric	May-21	Jun-24	Jun-25	Δ week
Copilot workflows	100	121	125	+4
model overrides	15	42	67	+25 🚀
experiments	16	37	39	+2
cache-memory	30	72	72	→ plateau
min-integrity	—	35	35	0 (regression)
max-tool-denials	0	0	0	❌ no change
mcp.tool-timeout	0	0	0	❌ no change

---

✅ Action Items

Immediate (one-liners, this week):

• Add max-tool-denials: 5 to all 63 copilot-sdk: true workflows
• Add engine.mcp.tool-timeout: 90s to all 72 cache-memory workflows
• Identify & restore min-integrity on the 8 regressed workflows

Short-term (this month):

• Add engine.token-weights to workflows using non-default models (67)
• Pilot grumpy-reviewer agent in a PR review workflow
• Add engine.mcp.session-timeout: 4h to workflows with timeout-minutes ≥ 30

Long-term (this quarter):

• Compiler lint rule: warn when copilot-sdk: true missing max-tool-denials
• Standardize a safety-defaults workflow template
• Audit/archive the 5 unused agent persona files

---

View Available But Unused Engine Features

All verified against pkg/workflow/engine.go (EngineConfig struct):

Feature	Syntax	Use case
engine.args	args: [--flag, value]	Pass extra CLI flags not exposed by compiler
engine.api-target	api-target: api.acme.ghe.com	GHEC/GHES custom API endpoint
engine.harness	harness: custom.cjs	Replace built-in Node.js harness for custom retry logic
engine.token-weights	token-weights: {multipliers: {input: 1.5}}	Custom AI cost calibration per model
engine.mcp.session-timeout	mcp: {session-timeout: 4h}	MCP gateway session TTL
engine.mcp.tool-timeout	mcp: {tool-timeout: 90s}	Per-MCP-call timeout
max-tool-denials	max-tool-denials: 5	Stop SDK after N repeated tool denials
network.blocked	blocked: [bad.example.com]	Explicit domain denylist
tools.startup-timeout	startup-timeout: 60s	MCP server startup wait

---

References: §28147943509 · §28076257791 · prior research

Generated by 🔬 Copilot CLI Deep Research Agent · 116.6 AIC · ⌖ 24.9 AIC · ⊞ 7.4K · ◷

• expires on Jun 25, 2026, 9:11 PM UTC-08:00